System and method for access control via mobile device

ABSTRACT

A system is described for controlling an actuating unit that restricts physical access such as a motorized garage door actuator unit. The system comprises a mobile wireless communication device, an electro-mechanical access control security device, and a receiving unit controlling the electro-mechanical access control security device, the receiving unit paired with the mobile wireless communication device for receiving user input for activating the electro-mechanical access control security device via a peer-to-peer communication directly with the mobile wireless communication device, and a pre-authorization of communication of the receiving unit with the mobile wireless communication device, the mobile wireless communication device receiving the pre-authorization from a central security server.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is related to, and claims priority from, U.S.Provisional Application No. 61/430,621 (Att. Docket 271152) filed onJan. 7, 2011, and entitled “System and Method for Access Control ViaMobile Device,” which is incorporated by reference herein in itsentirety, including any references contained therein.

This application is related to, and claims priority from, U.S.Provisional Application No. 61/584,043, filed on Jan. 6, 2012, andentitled “System and Method for Access Control Via Mobile Device,” whichis incorporated by reference herein in its entirety, including anyreferences contained therein.

This application is related to U.S. application Ser. No. 13/162,334filed on Jun. 16, 2011, which is a non-provisional of provisional U.S.Application No. 61/355,303 (Attorney Docket No. 269673) filed Jun. 16,2010, and entitled “Wireless Device Enabled Locking System,” thecontents of which are incorporated herein by reference in their entiretyfor all that they teach.

FIELD OF THE INVENTION

This invention relates generally to the field of security lockingdevices and access control, and more specifically to electronicallyactivated access control via mobile wireless communication devices withcomputer application program execution capabilities.

BACKGROUND OF THE INVENTION

Mechanically and/or electro-mechanically operated doors serve animportant function in both commercial and residential contexts todayensuring that personnel and/or visitors who are not authorized to accessparticular premises or secured items are restricted from such access,while providing access to the intended parties. Either an unauthorizedaccess or an unintended refusal of access can have financialconsequences and/or cause delay and disruption. Thus, when conditionsand/or persons subject to physical access control to premises orrestricted items change dynamically, access management becomes animportant priority.

It will be appreciated that this background description has beenpresented to aid the reader in understanding the aspects of theinvention, and it is not to be taken as a reference to prior art nor asan indication that any of the indicated problems were themselvesappreciated in the art.

BRIEF SUMMARY OF THE INVENTION

Illustrative examples of the invention provide a system for controllingphysical access. The system comprises a central security server, amobile wireless communication device supporting a plurality of wirelesscommunication technologies including: mobile wireless, and short-rangewireless. In addition, the system includes an electro-mechanical accesscontrol security device (e.g., a garage door actuator). The system alsoincludes a receiving unit controlling the electro-mechanical accesscontrol security device, wherein the receiving unit is adapted to bepaired with a host on the mobile wireless communication device forreceiving user commands for activating the electro-mechanical accesscontrol security device via a plurality of modes. The plurality of modesincludes a remote mode solely using a peer-to-peer communicationdirectly with the mobile wireless communication device via theshort-range wireless communication technology. The plurality of modesfurther includes a global mode using a pre-authorization, obtained bythe host on the mobile wireless communication device from the centralsecurity server via the mobile wireless technology, for a user commandissued from the mobile wireless communication device to the receivingunit via the short-range wireless communication technology.

BRIEF DESCRIPTION OF THE DRAWINGS

While the appended claims set forth the features of the presentinvention with particularity, the invention and its advantages are bestunderstood from the following detailed description taken in conjunctionwith the accompanying drawings, of which:

FIG. 1 illustrates a system for controlling an electro-mechanical accesscontrol security device, such as a garage door lift (actuator) unit, oralternatively a secure door, such as a commercial safe or vault, via amobile wireless communication device in accordance with an illustrativeexample of the invention;

FIG. 2A illustrates another illustrative example of the system of FIG. 1that includes access pre-authorization via a web server for a mobilewireless communication device operating in a Global mode, in accordancewith an illustrative example of the invention;

FIG. 2B illustrates a further illustrative example of the system of FIG.2A;

FIG. 3 is a flowchart summarizing an exemplary configuration of a systemsupporting both global and remote operational modes for a secure accesssystem; and

FIG. 4 is a flowchart summarizing a sequence of operations performed inaccordance with an access request issued and processed in accordancewith a global operational mode.

DETAILED DESCRIPTION OF THE DRAWINGS

Turning to FIG. 1, an illustrative example of a system 100 is shown thatutilizes multiple wireless communication technologies (e.g., protocols,standards) to control operation of electro-mechanical devices associatedwith, for example, limiting physical access to secure enclosures.Illustrative examples described herein include access control securitydevices such as electrically actuated locks, garage door openers,electrically actuated gates and/or vehicle or person entry barriers, aswell as electrically actuated secure doors, such as those for acommercial safe or vault, gun and/or ammunition safe, gun and/orammunition cabinet, etc. Further illustrative examples relate to otherenclosures, compartments and things to which secure restricted access isdesired utilizing the described wirelessly controlled secure (e.g.,encrypted) access technology.

The systems and methods described herein include a mobile wirelesscommunication device such as a smart cellular wireless phone, a portable(e.g., tablet) computer, or the like, configured to transmit an actuatorcontrol signal via a secure wireless communication (e.g., encryptedBluetooth) link to a receiver to activate an actuator associated withsecure restricted access to a space (e.g., an enclosed garage 101). Anillustrative example of the receiver is a receiving unit that triggersan access control actuator using a signal path parallel to an existingphysical signal source that also triggers the access control actuator(e.g., a keypad or other previously installed access authenticationdevices including fingerprint readers, encrypted USB driveauthenticators, etc.). The described mobile wireless communicationdevice-based remote activation of a secure access control actuator (alsoreferred to herein as a “Controller”) enhances secure access optionswhile maintaining a high level of confidence in the integrity of thesecurity of the system. Alternative illustrative examples also includewireless restricted access control via systems and methods describedherein.

In an illustrative example depicted in FIG. 1, the system 100 includes amobile wireless communication device 102 (e.g., a cell phone). Thecommunication device 102, is also referred to herein as a “Host” whenproperly configured with a program module to implement communicationswith a receiving unit 104 in accordance with functionality describedherein. The mobile wireless communication device 102 communicates in amobile wireless network via a cell tower 103. The mobile wirelesscommunication device 102 is capable of accessing a data network via acellular service provider associated with the cell tower 103. Moreover,the communication device 102 includes embedded encrypted Bluetoothwireless communications technology for transmitting commands from theHost to an access control device (e.g., the receiving unit 104 fortransmitting a control signal to a garage door lift unit 106), referredto herein as a “Controller.”

Illustrative examples of the system described herein employ both“global” and “remote” wireless control operational modes. Both globaland remote operational modes are described herein below with referenceto FIG. 1 (remote) and FIGS. 2A and 2B (global). The global mode ischaracterized by the communication device 102 (Host) accessing a servervia the Internet to obtain pre-authorization to issue a command toperform a specified operation (e.g., open a garage door) to thereceiving unit 104. Such pre-authorization request is repeated each timea user seeks to issue a command via the communication device 102 to thereceiving unit 104. The remote mode is characterized by localizedcommunications between a master user via the communication device 102and the receiving unit 104 during configuration of an access definition.The access definition specifies a set of authorized users of thereceiving unit 104 and scope of permitted access to the command set ofthe receiving unit 104 by the authorized users on an individual userbasis. The user database and associated authorizations are maintainedlocally by the receiving unit 104. Each of the two operational modesuses a subset of security (e.g., encryption) protocols and communicationtechnologies to ensure secure communications within a personal networkover which the mobile wireless communication device 102 and thereceiving unit 104 communicate to perform configuration and/or controlfunctions. While the global operational mode requires Internet access bya Host operating on, for example, the mobile wireless communicationdevice 102, the remote operational mode needs only the local PANconnection between the Host and the receiver 104 to carry outconfiguration and operation of the access control functionality of thereceiver 104 for the lift unit 106.

The global operational mode, carried out in a network configuration ofthe type described herein with reference to FIGS. 2A and 2B,incorporates communications between the mobile wireless communicationdevice 102 and a Web server 202 on the Internet to provide secure accessservices. Such services include configuring secure access controlcommunications between the mobile wireless communication device 102 andthe receiving unit 104 of the illustrative secure garage door actuatorunit. The Web server 202 includes configurable databases supportingauthentication, authorization and audit functions relating to secureaccess to a physical enclosure or locked device. The users and relatedaccess parameters are initially stored in the databases of the Webserver 202. Thereafter, identified users of Hosts (e.g., communicationdevice 102) access the Web server 202 to receive pre-authorization toissue a command (e.g., “open”) to the receiving unit 104. To that end,the database of users for a particular controller (e.g., receiving unit104) comprises, for each user record, the following exemplary fields:user ID, PIN/password, and operational parameters (e.g., allowedcommands and associated time spans where commands are permitted). TheWeb server 202 also maintains an audit trail for each Controller (e.g.,receiving unit 104) listing a set of access events. The audit trailincludes, by way of example, the following for each access event: timestamp, requester's ID, authentication result, command pre-authorized,and result. These fields are merely illustrative and other fields andpotentially stored data types for users and access events maintained bythe Web server 202 are contemplated for various embodiments of theglobal mode of operation of the exemplary system.

In contrast, the remote operational mode relies upon localcommunications between the communication device 102 (operating as a“master” host device having configuration permissions) and receivingunit 104 on a short-range personal network (e.g., via encryptedBluetooth) to configure secure access control on the system 100illustratively depicted in FIG. 1. The remote operational mode does notutilize the Web server 202 as all communications are localized on thepersonal area network defined by the communication device 102 andreceiving unit 104. The above-described configuration and operationdatabase information, stored on the Web server 202 in the global mode,is stored locally on the receiving unit 104 for the remote operationalmode.

As will be explained further herein below the system, including thereceiving unit 104 and communication device 102, supports both globaland remote operational modes. Moreover, the ability of users to exploitthe global and remote operational modes is designated on a communicationdevice-by-device and/or user-by-user basis. As a consequence, aparticular configuration of a personal area network established by thereceiving unit 104 and a set of mobile wireless communication devices(e.g., communication device 102) can include designating/authorizingcertain devices and/or users to operate in the global mode and otherdevices and/or users to operate in the remote mode. Thus, inillustrative examples mobile wireless communication devices operating inone or both the global and remote operational modes are intermixed in asame personal area network (PAN).

Continuing with the overview of the illustrative examples provided inFIGS. 1, 2A and 2B, users are identified using standard definitionsHost/Controller Interface terminology. A host communication stackresides in the mobile wireless communication device 102 and a controllercommunication stack resides in any device, such as the garage dooropener receiving unit 104, intended to receive an actuator controlsignal from the communication device 102. As shown schematically in FIG.1, the receiving unit 104 is signally connected via a local wire link toa garage door lift unit 106 that physically actuates a connected garagedoor (not shown). In the illustrative example, the local wire link isshared with a conventional pushbutton door switch 108—thus parallelsignaling paths couple the receiving unit 104 and the pushbutton doorswitch 108 to the garage door lift unit 106. An existing remote 110 (viaa wireless link to a wireless transceiver incorporated into the liftunit 106) and/or the door switch 108 operate the garage door in additionto the newly added access control functionality via the mobile wirelesscommunication device 102 and the receiving unit 104.

In an illustrative example, the mobile wireless communication device 102and the receiving unit 104 communicate via serial port emulation RFCOMMand use an encrypted link key for pairing. Secure Simple Pairing withnumeric comparison is used between a Host operating on the communicationdevice 102 and the Controller (receiving unit 104). In one illustrativeexample, the security of the pairing uses an E22 algorithm. Since thepairing method and the like are public pairing methods, the personalarea network link, over which the communication device 102 (Host) andthe receiving unit 104 (Controller) communicate, uses a privateencryption engine in addition to available “standard” Bluetoothencryption engines.

An initialization sequence for a pairing operation typically beginsafter the receiving unit 104 (Controller) is installed (i.e., attachedto the lift unit 106). The receiving unit 104 is pre-configured with aunique serial number during manufacturing and a unique security passcode (the link key is generated by the Bluetooth protocol and used forauthorization when paired Host/Controller devices communicate with eachother).

The pairing operation is further enhanced by adding one or more of thefollowing measures described herein below. A pairing data packetincludes a serial number assigned to the receiving unit 104(Controller). The pairing data packet includes the mobile phone numberof the mobile wireless communication devices 102 (Host). This additionalpairing data packet information is transmitted during the pairingoperation and is processed in a central processing unit of the receivingunit 104.

The pairing operation also controls the “visible” state of the receivingunit 104 (Controller). A “visible” status is characterized by theability to pair the receiving unit 104 (Controller) with Hosts (e.g.,the communications device 102). The visible status data is stored andprocessed by the Controller as required by the demand of the inquiry viaa communication to a Host such as the mobile wireless communicationdevice 102.

By providing encryption (e.g., as taught in the above-referenced U.S.application Ser. No. 13/162,334, which is a non-provisional ofprovisional U.S. Application No. 61/355,303) along with the aboveinformation, the personal area network utilized by the communicationdevice 102 and receiving unit 104 is enhanced against passive and activehacking. Moreover, the encryption controls access to the Controllersubroutines within the receiving unit 104 for access and the like fromunwanted non-authorized Hosts such as the communication device 102. Theabove-described approach for pairing the Host (e.g., communicationdevice 102) with the Controller (receiving unit 104) prevents anunauthorized communication device from pairing with the Controller(receiving unit 104) and operating the lift unit 106 via the Controller(receiving unit 104).

As mentioned above the system 100 supports both Remote and Globaloperational modes. The Remote operational mode permits user(s) of Hostdevices (e.g., communication device 102) to use the Controller(receiving unit 104) via peer to peer communications between the Host(communication device 102) and the Controller (receiving unit 104)without having to utilize a web or data connection. With reference toFIGS. 2A and 2B, the global operational mode requires that the Host(communication device 102) contact the Web server 202 to obtainpre-authorization before issuing a command (e.g., “open”) to theController (receiving unit 104).

Referring to FIG. 2B, another illustrative example of the system of FIG.2A operating in the global mode is shown. The system operates inconjunction with a Z-WAVE home automation system coupled to thereceiving unit 104. For instance, the Z-WAVE transceiver 206,electronically coupled to the receiving unit 104, makes the homeautomation functionality provided by the Z-WAVE system available via theuser interface of the communications device 102, such as for controllinga lamp, a light switch, a thermostat, providing pool control and/orother home automation functionality via the Host device. In anillustrative example, the Z-WAVE transceiver 206 receives a signal fromthe receiving unit 104, which acts as a gateway for receiving apeer-to-peer Bluetooth signal from the mobile wireless communicationdevice 102, and either opens the garage door if selected via the mobilephone/Host device user interface or operates some other remotecontrolled device such as a front door, for example, through the Z-WAVEhome automation system.

Having provided a general overview of the functionality of a systemsupporting both global and remote operational modes of secure access,attention is directed to a flowchart depicted in FIG. 3 summarizing amethod for configuring and commencing operation of the above-describedsystem in both global and remote operational modes. In an illustrativeexample, configuring and/or pairing operations on mobile wirelesscommunication devices, such as communication device 102, requires aprogram module comprising computer executable instructions to beinstalled on the mobile wireless communication device to implement Hostfunctionality. At least one communication device must download theprogram module to enable the communication device to implement master(configuration of users) functionality. Thus, during 300 the programmodule is stored on computer readable memory (e.g., flash, RAM, ROM, orother types of non-transitory computer readable media) of thecommunication device 102. The program module includes executableinstructions for performing the pairing operation along with master Hostfunctionality for setting a variety of operational parameters for thepersonal area network over which Hosts (e.g., configured version ofmobile wireless communication device 102) and the Controller (receivingunit 104) communicate. In an illustrative example, the personal areanetwork is limited by the Bluetooth microcomputer standard/protocol tooperate with seven (7) distinctly identified entities. In an alternativeillustrative example, Bluetooth control is placed in the Controller(receiving unit 104).

Moreover, it is noted that the initial pairing and activation sequencebetween the Controller (receiving unit 104) and a first (master) Hostoperating on the communication device 102, uses a hidden master pin thatis provided to the user, for example via an affixed tag/stickerphysically attached to the Controller (receiving unit 104). The masterpin is used by the user of the master Host to perform operations thatare permitted only on the Host device such as configuring additionaluser Hosts for the Controller (receiving unit 104) described hereinbelow with reference to step 302.

The Controller (receiving unit 104 in FIGS. 1, 2A and 2B) is capable ofsimultaneously pairing with multiple Hosts (e.g., communication device102), with each Host having an individually specified access parameterspecification (e.g., access time of day, single use, etc.). Thus, during302, the mobile wireless communication device 102 executes master Hostfunctionality, provided by the host program installed during step 300,to present a configuration user interface for configuring a set of users(communication devices such as communication device 102) that arepermitted to issue secure commands to a particular controller (e.g.receiving unit 104). Information configured by the master Host during302 for each user includes, for example, the following: user name, phonenumber, (master Host) PIN, operational parameters (permissions). Inaddition, during 302 the master Host designates, on a user by userbasis, whether the user operates in the remote and/or global operationalmode. In an illustrative example, the operational parameters for aparticular user include a number specifying a total number of allowedaccesses (e.g., how many “open” commands can be issued to a garage dooractuator). The individual user operational parameter configurations alsosupport specifying a time period (e.g., day of week, time span withinday, number of days from a start date) when a user is permitted access.It is explicitly noted that step 302 can be revisited multiple timesafter the first instance by the master Host to modify the set ofauthorized users (Hosts) and/or their associated operational parametersregarding issuing commands to a specific Controller (e.g., receivingunit 104).

With continued reference to the flowchart of FIG. 3, during 304 themaster Host determines whether any global user configurations arepresent as a result of previous user configuration operations. If newglobal user configurations are present, then control passes to step 306.During 306 the master Host, operating on the communication device 102,uploads the global user configurations, for accessing the Controller(receiving unit 104), to the Web server 202 using any of a variety oftransmission modes (e.g., GPRS, UTMS, EDGE, CDMA, etc.) supported byvarious mobile wireless service providers. Prior to uploading the globaluser information during step 306, the master Host performs a pairingoperation with the Controller (receiving unit 104) wherein the masterHost is authenticated and authorized to upload the user configurationsto the Web server 202. During pairing, the master Host provides a serialnumber corresponding to the Controller (receiving unit 104) and a PINassigned to the particular Controller during manufacturing. The masterHost and the Controller utilize secure (e.g., encrypted Bluetooth)communications during the pairing operation. During step 306, the Webserver 202 matches the configuration information uploaded from themaster host (communication device 102) with the proper Controller by theserial number assigned to, and uniquely identifying, the receiving unit104. If no global user configurations are pending, then control passesfrom 304 to step 308.

It is noted that the remote operational mode uses a designated Hostdevice as a primary input device (master) for configuration user accessto the Controller (receiving unit 104). Thus, with continued referenceto the flowchart of FIG. 3, during 308 the master Host determineswhether any remote user configurations are present as a result ofprevious user configuration operations that need to be downloaded to theController (receiving unit 104). In an illustrative example, the remoteuser configurations are created when the master Host user (incorporatedinto communication device 102) administers and adjusts theconfigurations for other remote users locally on the communicationdevice 102. The master Host adds/deletes users and specifies associatedoperational parameters for each user.

If new remote user configurations are present, then control passes tostep 310. During 310 the master Host, operating on the communicationdevice 102, downloads the remote user configurations, for accessing theController (receiving unit 104), to the Controller (receiving unit 104).The modified remote user configurations are downloaded via an encryptedBluetooth connection between the communication device 102 (running themaster Host) and the Controller (receiving unit 104). Step 310 beginswith the above-described pairing operation between the master Host(communication device 102) and the controller (receiving unit 104).However, in contrast to step 306, during step 310 the master Hostdownloads the remote user configurations to the Controller (receivingunit 104). The Controller (receiver 104) stores the user configurationson a non-transitory computer readable memory medium. Thus, no Internetaccess is needed during step 310. Upon completion of step 310, thetransfer of global user configurations to the Web server 202 and remoteuser configurations to the Controller (receiving unit 104) is complete.Control passes to the END. If no remote user configurations are pending,then control passes from step 308 to the END.

It is noted that, by way of example, during setup of the master Host onthe communication device 102, an option of automatically sending an SMSmessage to the new configured users is available. The SMS messagenotifies each new user to go to a web site from which the Hostapplication can be downloaded, or alternatively secure a physical copyof the Host application to load on the mobile wireless communicationdevice 102.

In an illustrative embodiment, information downloaded to the Controller(receiving unit 104) during step 310 facilitates automatic pairingauthorization for new remote users of non-master Hosts with theController (receiver 104). During the download of user configurationinformation to the Controller (receiving unit 104) during step 310, themaster Host (communication device 102) presets the controller (receivingunit 104) to allow pairing activation based on secret informationprovided by a previously non-paired user Host to the Controller(receiver 104) during an initial scanning when a communication devicecontaining the new user Host is within range of the Controller (receiver104). Pairing must still occur, but the master Host has provided, to theController, a data packet designed to set necessary pairing information(e.g., the new user's phone number) into the new Host when it contactsthe Controller to initiate pairing.

Having described configuration of the global and remote operationalmodes for Hosts incorporated into and executed on mobile wirelesscommunication devices such as device 102, attention is directed to theexecution of access requests by Hosts in accordance with the globaloperational mode (FIG. 4) and remote operational mode. Turning to FIG.4, it is generally noted that when a Host operates in the globaloperational mode, the communication device 102 connects to the Webserver 202 to receive authorization for each access request submitted bythe Host (communication device 102) to the Controller (receiving unit104). Thus, each access request by the Host (communication device 102)is treated by the system as a unique event that is tracked and saved inan audit log maintained on the Web server 202. In the illustrativeexample, during step 400, the user of the communications device 102activates (opens) the program module (e.g., application program)embodying the Host functionality described herein, and the user selectsthe Controller of interest. In this example, the receiving unit 104 isselected via a user interface provided by the Host interface displayedon the communications device 102.

Next, during step 402 the Host (communication device 102) connects tothe Web server 202 to obtain authenticated authorization to access theselected Controller (receiving unit 104)—i.e., issue a command to becarried out by the receiving unit 104 to issue a signal to an accesscontrol actuator. The request from the Host to the Web server includes,for example, the following: user identification, authenticationinformation (e.g., PIN), Controller identification, and type of request(e.g., open door). If the request (e.g., open door) from the Host to theWeb server 202 is within the limitations (e.g., time of day, type ofaction requested) specified in the operational parameters given to theidentified user, the Web server 202 sends an authorization data packetto the requesting user's communication device 102. The Host executing onthe communication device 102 then sees that it has been authorized bythe server 202.

During step 404, the Host operating on the communication device 102sends the authorized request to the Controller (receiving unit 104) tocarry out the authorized secure access command by sending an appropriatecontrol signal to a physical actuator for providing secure access (e.g.,garage door opener, an electro-mechanical doorway lock and/or openermechanism, a safe lock, including a gun safe lock, a lock box lock, acabinet door lock, including a gun cabinet door lock, a security gateand/or entry barrier, or another access control device that is beingactivated by the receiving unit 104).

During step 406, the Controller (receiving unit 104) issues a condition(result/status) message to the Host on the communication device 102.Thereafter, during step 408, the Host sends the result/statusinformation contained in the condition message to the web server 202.The web server 202 records information pertaining to each separate user(Host) authorization request and result/status conditions that followedsubmission of an authorized request. Conditions that are generatedinclude, but are not limited to, the actual physical position of theaccess control device that received a command from the Controller as aresult of the authorized request being received by the Controller. Suchpositions include the following: Open/Closed access device position,jammed access device status, improper access attempt indicator, etc. Inthe illustrative example, all of the above data packets are encryptedusing a private encryption engine as described in U.S. application Ser.No. 13/162,334 filed on Jun. 16, 2011, which is a non-provisional ofprovisional U.S. Application No. 61/355,303 (Attorney Docket No. 269673)filed Jun. 16, 2010. The described encryption prevents hacking thesecure codes needed to access by sniffing (blue jacking) the signalseither passively or actively. Alternatively, the encryption can becombined with an E0 stream cipher if required.

The remote operational mode for issuing access commands from the Hostoperating on communication device 102 is performed without accessing theWeb server 202. Rather, the user of the communications device 102activates (opens) the program module (e.g., application program)embodying the Host functionality described herein. The user may,depending on the level of security of the system, initially be requiredto enter a password to receive access to controller devices configuredon the Host executing on the communications device 102. The user selectsthe Controller (receiving unit 104) of interest and then activates acommand (e.g. open) on the selected Controller. Encrypted Bluetooth isused to provide a secure communications link between the communicationsdevice 102 and the receiving unit 104. In this example, the receivingunit 104 is selected via a user interface provided by a Host graphicaluser interface displayed on the communications device 102.

In one illustrative example, the system includes a position switchsensor, such as a magnet and a magnetic switch sensor, installed at thedoor or other secure access device. The position switch sensor is incommunication with the Controller 104 so as to provide the Controller104 with the open/closed status of the associated secure access device.The Host (e.g., communication device 102) communicates with theController (receiver 104) to poll the Controller (receiver 104) for theopen/closed status of the associated secure access device and displaythe open/closed status via the Host device's user interface. In the caseof the above illustrative garage door control example, the Host(communication device 102) user is able to remotely ascertain whetherthe garage door is currently open or closed. In an illustrative example,the user is further able to send an open/close command via the Hostdevice to change the status of the secure access device.

All references, including publications, patent applications, andpatents, cited herein are hereby incorporated by reference to the sameextent as if each reference were individually and specifically indicatedto be incorporated by reference and were set forth in its entiretyherein.

The use of the terms “a” and “an” and “the” and similar referents in thecontext of describing the invention (especially in the context of thefollowing claims) are to be construed to cover both the singular and theplural, unless otherwise indicated herein or clearly contradicted bycontext. The terms “comprising,” “having,” “including,” and “containing”are to be construed as open-ended terms (i.e., meaning “including, butnot limited to,”) unless otherwise noted. Recitation of ranges of valuesherein are merely intended to serve as a shorthand method of referringindividually to each separate value falling within the range, unlessotherwise indicated herein, and each separate value is incorporated intothe specification as if it were individually recited herein. All methodsdescribed herein can be performed in any suitable order unless otherwiseindicated herein or otherwise clearly contradicted by context. The useof any and all examples, or exemplary language (e.g., “such as”)provided herein, is intended merely to better illuminate the inventionand does not pose a limitation on the scope of the invention unlessotherwise claimed. No language in the specification should be construedas indicating any non-claimed element as essential to the practice ofthe invention.

Illustrative examples of this invention are described herein, includingthe best mode known to the inventors for carrying out the invention.Variations of those preferred illustrative examples may become apparentto those of ordinary skill in the art upon reading the foregoingdescription. The inventors expect skilled artisans to employ suchvariations as appropriate, and the inventors intend for the invention tobe practiced otherwise than as specifically described herein.Accordingly, this invention includes all modifications and equivalentsof the subject matter recited in the claims appended hereto as permittedby applicable law. Moreover, any combination of the above-describedelements in all possible variations thereof is encompassed by theinvention unless otherwise indicated herein or otherwise clearlycontradicted by context.

What is claimed is:
 1. A system for controlling physical accesscomprising: a central security server; a mobile wireless communicationdevice supporting a plurality of wireless communication technologiesincluding: mobile wireless, and short-range wireless; anelectro-mechanical access control security device; a receiving unitcontrolling the electro-mechanical access control security device,wherein the receiving unit is adapted to be paired with a host on themobile wireless communication device, and wherein the receiving unit isadapted for receiving user commands from the paired host for activatingthe electro-mechanical access control security device via a plurality ofmodes including: a remote mode solely using a peer-to-peer communicationdirectly with the mobile wireless communication device via theshort-range wireless communication technology; and a global mode using apre-authorization, obtained by the host on the mobile wirelesscommunication device from the central security server via the mobilewireless technology, for a user command issued from the mobile wirelesscommunication device to the receiving unit via the short-range wirelesscommunication technology.
 2. The system of claim 1 wherein the centralsecurity unit is adapted to store configuration information for a set ofhosts, the configuration information being used to provide thepre-authorization to the host on the mobile wireless communicationdevice.
 3. The system of claim 1 wherein the host and receiving unit areadapted to carry out an initializing pairing operation using encryptedpeer-to-peer communications.
 4. The system of claim 3 wherein thepeer-to-peer communications utilize Bluetooth short-range wirelesscommunications technology.
 5. The system of claim 1 wherein individualones of a set of hosts are configured to operate in the remote and/orglobal mode on an individualized host-by-host basis.
 6. The system ofclaim 1 wherein the mobile wireless technology is a cellular wirelesstechnology.
 7. The system of claim 6 wherein the mobile wireless deviceis a cellular phone adapted to execute application programs.
 8. Thesystem of claim 6 wherein the mobile wireless devices is a tabletcomputer.